Splunk Search

How to convert kb to GB?

peasead
Path Finder

How do I convert this query to display the results in GB instead of kb?

index="_internal" source="*metrics.log" per_sourcetype_thruput | chart sum(kb) by series

Currently I'm just do a ~result~/1024^2 in Excel, but it'd be stellar to not have to do that as I'm sure Splunk can do the conversion for me.

Also, is there an efficient way to get the results to be listed by Source instead of Source Type? Replacing "per_sourcetype_thruput" with "per_source_thruput" displays all the individual .log files and takes a long long time to complete. If that's the only way, that's fine, I just didn't know if there was another way.

Labels (1)
Tags (3)
0 Karma
1 Solution

hexx
Splunk Employee
Splunk Employee

Very simple :

index="_internal" source="*metrics.log" per_sourcetype_thruput | chart sum(eval(kb/1024/1024)) AS GB by series

I am not sure of how you would like results to be listed by source other than by listing all file names / input sources. Could you elaborate on that? What kind of report would you like to see?

View solution in original post

ldongradi_splun
Splunk Employee
Splunk Employee

You can use the power of 1024, and anticipate the use of a macro, plus you need to use eval out of the sum() if you want to round the results:
index="_internal" source="*metrics.log" per_sourcetype_thruput| chart sum(kb) as Size by series
| eval KB=round(Size/pow(1024,0),2), MB=round(Size/pow(1024,1),2), GB=round(Size/pow(1024,2),2)
| table series, Size, KB, MB, GB

0 Karma

hexx
Splunk Employee
Splunk Employee

Very simple :

index="_internal" source="*metrics.log" per_sourcetype_thruput | chart sum(eval(kb/1024/1024)) AS GB by series

I am not sure of how you would like results to be listed by source other than by listing all file names / input sources. Could you elaborate on that? What kind of report would you like to see?

peasead
Path Finder

Thanks!

That worked!

0 Karma

tfujita_splunk
Splunk Employee
Splunk Employee

This could be also solution for you.

index="_internal" source="*metrics.log" per_sourcetype_thruput
| chart sum(eval(kb*1024)) AS bytes by series

```THE FOLLOWING LINES MAY BE WHAT ACHIEVES THE FORMAT YOU ARE LOOKING FOR.```
| fieldformat bytes=printf("% 10s",printf("%.2f",round(bytes/pow(1024,if(bytes=0,0,floor(min(log(bytes,1024),10)))),2)).case(bytes=0 OR log(bytes,1024)<1,"B ", log(bytes,1024)<2,"KiB", log(bytes,1024)<3,"MiB", log(bytes,1024)<4,"GiB", log(bytes,1024)<5,"TiB", log(bytes,1024)<6,"PiB", log(bytes,1024)<7,"EiB", log(bytes,1024)<8,"ZiB", log(bytes,1024)<9,"YiB", log(bytes,1024)<10,"RiB", log(bytes,1024)<11,"QiB", 1=1, "QiB"))

 

Another option is installing add-on Numeral system macros for Splunk enables you to use macros numeral_binary_symbol(1) or numeral_binary_symbol(2).

Example

index="_internal" source="*metrics.log" per_sourcetype_thruput
| chart sum(eval(kb*1024)) AS bytes by series

```THE FOLLOWING LINES MAY BE WHAT ACHIEVES THE FORMAT YOU ARE LOOKING FOR.```
| fieldformat bytes=printf("% 10s",`numeral_binary_symbol(bytes,2)`)

 

Numeral system macros for Splunk

https://splunkbase.splunk.com/app/6595


Usage:

How to convert a large number to string with expressions of long and short scales, or neither.

https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-large-number-to-string-with-expressio......

Tags (5)
0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...